Penetration Testing Find Exploitable Vulnerabilities Before Attackers Do

A penetration test is a permission-based, time-boxed simulation of a real cyberattack against your environment. Petronella ethical hackers chain together reconnaissance, vulnerability discovery, exploitation, and lateral movement the same way a financially motivated attacker or nation-state operator would. The result is not a list of theoretical risks - it is a written account of what an attacker could actually do, with what credentials, in what timeframe, and what data they could touch on the way out.

Penetration testing differs from a vulnerability scan, a security questionnaire, or a checklist audit. A scanner reports that a service is missing a patch. A penetration test demonstrates whether that missing patch is actually reachable from the internet, whether the credentials harvested from it pivot into your finance VLAN, and whether the EDR you pay for catches the lateral move. The difference is the same as the difference between a smoke detector that beeps and a fire marshal who walks through the building with a flashlight.

For most regulated organizations the trigger is no longer optional. CMMC 2.0 Level 2 assessments under the new C3PAO regime expect documented security assessment evidence (NIST SP 800-171 control 3.12.1) that a passive review cannot satisfy. PCI DSS v4 Requirement 11.4 mandates annual external and internal penetration testing for any environment that touches cardholder data. HIPAA Security Rule technical evaluation at 45 CFR 164.308(a)(8) assumes a real test, not a self-assessment, when ePHI volumes are non-trivial. Cyber insurance underwriters increasingly attach a pen-test attestation to renewal pricing. The work is no longer a maturity exercise. It is documentary evidence that something held when something tried to break it.

Petronella has been doing this work in North Carolina since 2002. Our team holds CMMC-RP credentials across every engineer. Founder Craig Petronella holds CMMC-RP, CCNA, CWNE (Certified Wireless Network Expert), and a state-issued Digital Forensics Examiner credential, license number 604180. The firm is CMMC-AB Registered Provider Organization number 1449. We hold a BBB A+ rating continuously since 2003. None of those acronyms run a test by themselves, but they tell you who is going to be holding the keys to your environment for the duration of the engagement.

The CMMC 2.0 final rule, codified at 32 CFR Part 170 with the assessment process codified at 32 CFR Part 170 and 48 CFR (DFARS) updates pending the contract-clause rule, defines Level 2 as the protection level required for any defense contractor whose contract touches Controlled Unclassified Information. Assessments at Level 2 are conducted by an authorized C3PAO (Certified Third-Party Assessment Organization) and the pre-assessment evidence package is the difference between a clean conditional and a remediation cycle.

Petronella runs penetration tests sized to that package. Our deliverables include the Security Assessment Report tagged directly to NIST SP 800-171 Revision 2 controls in the 3.12 family (Security Assessment), the 3.11 family (Risk Assessment), and the 3.14 family (System and Information Integrity). The pen-test evidence then feeds the System Security Plan and the Plan of Action and Milestones submitted into the Supplier Performance Risk System (SPRS) under DFARS clause 252.204-7019.

Practice 1.1.2 in CMMC Practice Area 1 expects evidence of authorized access to CUI. A penetration test demonstrates the authorization boundary holds against the adversary model the practice contemplates. Practice 13.1.1 expects boundary protection - the pen test is the evidence that the boundary works under attempted breach. Our CMMC-RP team writes the narrative section so it reads the way a C3PAO assessor wants it to read on the day of the on-site visit.

If you are early in the CMMC journey we recommend pairing a Level 2 readiness pen test with a C3PAO selection conversation. The two scopes interlock and timing the pen test six to nine months before the formal assessment maximizes the value of the remediation runway. CMMC Level 1 contractors with FCI-only environments do not require a pen test by rule, but the same Practice family 3.12 expectations apply at the self-assessment standard, and we run shorter Level 1 engagements as well.

Mistake one: scoping by IP count instead of by attack surface. An asset that exposes a single port to the internet can produce more risk than ten internal workstations. The right scoping conversation starts with the data, the workflow, and the business obligation, not a netblock CIDR. Petronella scoping calls open with "what would an attacker want from you" and only then move to in-scope hostnames.

Mistake two: excluding the application that holds the regulated data. Web applications and APIs are routinely scoped out of network pen tests on the assumption they got tested last cycle. The application is exactly where exfiltration occurs. If the engagement is about CMMC, HIPAA, PCI, or SOC 2 evidence, the application is in scope or the deliverable does not cover the actual risk.

Mistake three: skipping internal testing. An external-only engagement reports the strength of the perimeter. It says nothing about what happens when one phished workstation lands inside the building. PCI DSS v4 names this explicitly at Requirement 11.4.2. CMMC L2 inherits the same expectation through control family 3.12. Skipping internal pen testing produces a report that satisfies neither.

Mistake four: undersized social engineering. A pen test with a five-target phishing simulation produces noise rather than data. Statistically meaningful phishing requires twenty plus targets minimum and an honest read of department-level click rates. Underscoped social engineering still costs operator hours and produces nothing actionable for the security awareness program.

Mistake five: no remediation runway in the engagement letter. A pen test that closes the day the report ships, with no agreed retest window, is an audit artifact rather than a security improvement. The free critical-and-high retest in the Petronella engagement letter exists exactly to prevent this. Schedule the retest inside the engagement letter, not after.

A Petronella penetration testing engagement closes with a four-part deliverable. The executive summary runs two to four pages and is written for the board, the audit committee, and your cyber insurance broker. It opens with the business-risk narrative - what an attacker could reach, what regulated data was in play, and what the dollar-impact estimate looks like under a reasonable assumption set. It closes with a prioritized remediation list so leadership can make budget decisions inside one read.

The technical findings appendix is the long document - typically 40 to 120 pages depending on scope. Each finding gets a unique identifier, a CVSS v3.1 base score, an environmental score adjusted for your context, a MITRE ATT&CK technique tag, evidence (screenshots, captured requests, payloads, log excerpts), likelihood and impact analysis, and a step-by-step remediation walkthrough. Findings are grouped by severity and by affected system so your engineers can attack the work in the order that closes the most risk per hour spent.

The remediation worksheet ships as a spreadsheet your IT team can drop into a ticketing system. Columns include finding ID, system affected, severity, owner placeholder, target close date, evidence-of-fix requirement, and retest status. The worksheet is the bridge between the appendix and the work that closes the loop.

The retest letter arrives once you have remediated critical and high findings. The retest is included at no additional cost. The letter says what we retested, what we confirmed remediated, and what we recommend track on the next engagement. That letter is the artifact your auditor or your insurer asks for at renewal.

Engagements also include a debrief call. Optional purple-team workshops are available for clients who want their internal detection and response team to walk every step of the attack tree alongside our operator and tune SIEM detections in real time.

The penetration testing report has the highest signal-to-noise ratio of any document in your security program. It tells you exactly what to fix and in what order. The thirty days that follow are where the value of the engagement is either realized or evaporated. Petronella structures the post-engagement window the same way every time.

Days one through five: the debrief call walks every critical and high finding with your IT lead, your CISO or vCISO, and where appropriate your auditor or compliance officer. We answer questions, demonstrate exploitation paths on request, and triage remediation ownership. The remediation worksheet leaves the call populated with owner names and target close dates.

Days six through fifteen: critical findings ship into the patch cycle and the change-management process. Where infrastructure-level changes are needed - firewall ACL revisions, identity provider hardening, segmentation enforcement - we are available on a quick call to validate the proposed fix matches the threat model the finding documented. Most critical findings close inside this window.

Days sixteen through twenty-five: high findings close. Awareness training adjusts to reflect what the phishing simulation revealed. Detection engineering tunes SIEM rules to fire on the MITRE ATT&CK techniques the operator chained, so the next attacker that walks the same path produces a same-day alert instead of a thirty-day dwell time.

Days twenty-six through thirty: Petronella runs the free retest of critical and high findings. The retest letter ships within five business days of the retest itself. That letter is the artifact your auditor, your insurer, your prime contractor, or your board wants to see, and it closes the engagement loop with documented evidence the remediation held.

Medium and informational findings are tracked on the worksheet for closure inside the next quarterly cycle, not the immediate window. The right cadence is to schedule the next penetration testing engagement at the eleven-month mark so the annual evidence requirement never lapses, and the threat model gets a fresh adversary look while the remediation muscle is still warm.